Slashdot videos: Now with more Slashdot!

View

Discuss

Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

cryan7755 and netbuzz both sent along a NetworkWorld story on Comcast's public test deployment of DNSSEC. Here is the company's blog post announcing the trial.
"Comcast this morning announced what is believed to be the first public test deployment of DNS Security Extensions. The company says it has deployed DNSSEC throughout its nationwide network and will immediately make validating servers available to customers. In addition, Comcast said it would digitally sign all of its own domain names using DNSSEC by early next year. 'There is often talk about a chicken-and-egg sort of problem with DNSSEC. People don’t want to sign their own domains with DNSSEC until people are validating signatures,' says Jason Livingood, Executive Director of Internet Systems Engineering at Comcast. 'We want to explain how we as an ISP have a roadmap for validating signatures with DNSSEC.'"

While there are many early adopters of DNSSEC today, including many Top Level Domains (TLDs) the linchpin event that most people are waiting for in order to get really excited about DNSSEC deployment is the signing of t

Dammit Chris, it's bad enough that your company is doing good things for the Internet like early IPv6 and DNSSEC adoption. Now you have the gall to come onto my Slashdot with your polite and informative answers. It's really starting to threaten my rage-induced perception of Comcast as World's Most Evil Cable Company and that's not something I'll give up without a fight!

The company is in the process of rebranding. It has started with a push during the 2010 Winter Olympic Games and has started in large markets. It is expected to continue transistioning through the end of this year.

Say what you will about their business practices, customer service, reliability, whatever... But when it comes to IPv6 and being involved in the technical community, they're kicking ass and taking names.

Assuming you use BIND, most places have something like this in named.conf on their customer facing DNS server so that only your paying users have access. Theoretically if some goofball tries a DNS amplifier attack you'll be able to track them more effectively on your own network... Also if everyone else forbid query and recursion, then you'd not be able to use their servers as an amplifier, and crippling your own ISPs DNS server seems rather counterproductive.

Assuming you use BIND, most places have something like this in named.conf on their customer facing DNS server so that only your paying users have access. Theoretically if some goofball tries a DNS amplifier attack

Holy bad proofreading... what I meant to say, is if I'm trying to attack someone "far away" and the DNS server ACL doesn't permit queries from that victim, then you can't forge their address as your source address and get the amp to amplify... the dns server sees a query from an address that is not permitted, and drops it. So if I'm on ISP A trying to DDOS someone on ISP C by using a DNS server on ISP B, if ISP B doesn't allow queries from ISP C, I can't do the DDOS.

Dear customer, we want your web browsing experience to be as secure as possible, however we still want to be able to hear you sing happy birthday to aunt Margaret. Did you decide to send her the chocolates and candles you were discussing with your sister?

Say what you want about Comcast's customer policies, it's clear that they're almost as foresighted as Google when it comes to deploying next generation networking technologies, not only deploying DNSSEC, but also beginning an opt-in IPv6 transition project.

In short: Credit where credit is due. At least *someone* is looking to the future and working toward it.

it's clear that they're almost as foresighted as Google when it comes to deploying next generation networking technologies

Except Google didn't try to kill bittorrent, come under a congressional investigation, and spark a row with the FCC over its use of "next generation networking technology". And while we're at it, how next generation is a network with a 250GB bandwidth cap?

Except Google didn't try to kill bittorrent, come under a congressional investigation, and spark a row with the FCC over its use of "next generation networking technology". And while we're at it, how next generation is a network with a 250GB bandwidth cap?

Uhuh... and that disproves my point how, exactly?

The simple fact is that Comcast is rolling out next-gen technologies for the Internet before anyone else. Now, you may not like how they're trying to manage the bandwidth in their backhaul network, but that

I'm pretty knowledgeable when it comes to new Internet tech, but I don't offhand know the benefits of DNSSEC or much about it other than it has to do with Doman Name Servers and Security (I assume encryption). Is it a complement to SSL? Does it help secure browsing sessions or is it more about identifying and authenticating legitimate domain names versus questionable ones? I guess I'll have to read up on it.

Console gaming over the Internet didn't really take off until this generation, in which all three major consoles use PowerPC CPUs. Wii uses a G3-based CPU called Broadway, PLAYSTATION 3 uses a Cell CPU with one PowerPC core plus seven DSPs, and Xbox 360 uses three of the PowerPC cores from the Cell CPU.

However, the same people that screw up their SSL / HTTPS config and convince everyone to just click thru the error messages, will be running/ruining their dnssec config

Well it's kind of funny that this is your complaint, since one of the reasons admins ask people to click through the error message is that they have self-signed certs because they don't want to pay ridiculous amounts of money to a CA. From what I understand, (which admittedly is limited) DNSSEC could possibly open the door to putting signed public keys into DNS records, which would mean you wouldn't really need SSL certificate authorities.

Fine, for the 1% of websites that bother with the "extended validation", they'll continue to do that. For everyone else, it really doesn't matter.

Or what, you think that most CAs actually verify anything? You think that if you registered www.hsbcbankusa.org (it's not taken!) that you couldn't get a certificate authority to give you a valid cert? Of course you could.

In 99% of cases, the point of SSL certs is not to validate the identity of the person running the site. The point is to encrypt traffic.

The internet is currently not controlled by anyone but DNSSEC changes this by requiring every domain to have a traceable certificate. Look for greater centralized control by people saying "think of the children" and "this will only be used to combat terrorism". It also pretty much guarantees that new clients will be written to allow DNS lookups in both the "official" root zone and under alternative roots.

The internet is currently not controlled by anyone but DNSSEC changes this by requiring every domain to have a traceable certificate. Look for greater centralized control by people saying "think of the children" and "this will only be used to combat terrorism". It also pretty much guarantees that new clients will be written to allow DNS lookups in both the "official" root zone and under alternative roots.

I thought I should clear up some worry:

1. DNS does not require DNSSEC. You can still have domains that work just like they do today that do not use the security extensions of DNSSEC. I.e., no more centralized control than you already have today with DNS.

2. On the other hand, I'm not sure what control 'the man' (heh) would have that they don't currently have with DNS. For.com domains, a user goes to the.com servers to find out which DNS they should query for a zone. With DNSSEC, a user would still go to th

You are currently not required to use DNSSEC, however once it becomes widespread it will become required. The reason is that the victims of phishing (banks, credit card companies, etc.) will demand it. ISPs and Registrars will have no reason to disagree because they make money from domain registrations.

The additional control is not over the lookup process, it is the centralized nature of the certificate and domain registration process. Good luck getting anyone to your site if you aren't trusted from root

Ah well, "Apple Acolyte" you may be pretty knowledgeable as far as being an Apple user goes, but part of being pretty knowledgeable in the rest of the world involves, I know it may come as a shock, but stay with me for a moment; reading the sodding article!!

Can't you see by his Slashdot ID that he's an old-school/.er? They never RTFA and rely on karma whores [guilty] to provide the information from the article in a very short and to the point snippet of quote.

Guaranteeing that the domain and IP address are what they should be is the benefit. In a properly configured DNSSEC deployment, with the appropriate security protecting your keys, then the man-in-the-middle attack that's currently capable with SSL today is next to impossible. Getting poisoned results could happen, but you're assured that it's not the correct response.

For example,.gov has signed some of their zones (failed to meet the mandate?). In an emergency, isn't it better to have the actual governm

Maybe I'm alone in this, but in an emergency whereby I'd be dependent on the government for water, I'm fairly certain that my first reaction is NOT going to bear any resemblance to the following: "My family hasn't had a drop of sanitary water in three days. I should use the Internet instead of the phone or TV or radio broadcasts and e-mail the president and ask him to help...wait, this doesn't look like an official website! Blast! Somebody must be hacking DNS servers to prevent me from getting water!"

If the roots signed and then.com signed, there would be some benefits over time as more and more domains sign their zones. If there was some policy as to getting the signing key from the parent, exammple.com may not be able to validate with DNSSEC and the ignorant might be a little more secure. The more that sign, the less spam you might get from a botnet or some spam house.

DNSSEC was designed to protect the Internet from certain attacks, such as DNS cache poisoning [0]. It is a set of extensions to DNS, which provide: a) origin authentication of DNS data, b) data integrity, and c) authenticated denial of existence.

You should read our FAQ on the DNSSEC trial, particularly this section:

http://www.dnssec.comcast.net/faq.htm#faq7

What happens to Comcast Domain Helper, which offers DNS redirect services, when you fully implement DNSSEC?We believe that the web error redirection function of Comcast Domain Helper is technically incompatible with DNSSEC.Comcast has always known this and plans to turn off such redirection when DNSSEC is fully implemented.The DNSSEC trial servers we are announcing today do not have Comcast Domain Helper's DNS redirect functionality enabled.We plan to update our IETF Internet Draft on this subject, available at http://tools.ietf.org/html/draft-livingood-dns-redirect, to reflect this in the coming months.

Thanks for taking the time to respond to slashdot comments. I truly hope Comcast keeps this up, and stays involved in community forums to support web standards and disseminate accurate technical information.

We believe that the web error redirection function of Comcast Domain Helper is technically incompatible with DNSSEC.

It's technically incompatible with the internet in general. This is at least part of the reason why ISPs have been dragging their feet on deployment. Now if only the FCC or FTC had some balls and mandated a time frame for full support of DNSSEC. To bad that would require change in how the government operates.

DNSSEC uses cryptographic signatures to authenticate DNS records and thereby prevents DNS spoofing. DNSSEC does not use encryption, only authentication, i.e. it provides trust, but not privacy.

DNS spoofing is an attack which can be used to redirect traffic to an attacker's server, where the attacker can intercept the traffic for a man in the middle attack or create an impostor service and harvest credentials. There are several countermeasures in plain DNS to prevent spoofing, but Dan Kaminsky's discovery of a fundamental spoofing vulnerability in the DNS protocol finally pushed DNSSEC out of the labs into the wild.

What happens to Comcast Domain Helper, which offers DNS redirect services, when you fully implement DNSSEC?

* We believe that the web error redirection function of Comcast Domain Helper is technically incompatible with DNSSEC.
* Comcast has always known this and plans to turn off such redirection when DNSSEC is fully implemented.
* The DNSSEC trial servers we are announcing today do not have Comcast Domain Helper's DNS redirect functionality enabled.
* We plan to update our IETF Internet Draft on this subject, available at http://tools.ietf.org/html/draft-livingood-dns-redirect [ietf.org], to reflect this in the coming months.

If someone can spoof DNS, why not just spoof routing? Now days, it is very common to connect through public wireless networks. You should not have to depend on the connection point not being hacked somehow. My understanding is that DNSSEC can supply host keys as well, so you can be sure that the host you actually connect to is the one defined by DNSSEC. Is it being implemented that way, or is it just being used to avoid DNS spoofing?

Also, are DNSSEC certificates designed in a way that generates profit for c

Well you can already do that through CAs of course, but once we have DNSSEC I expect RFC4985 to get implemented into browsers at which point yes... the DNS server will be able to supply host keys. I expect the CAs are scared shitless at the prospect.

A DNSKEY is put at the top of the zone. (ie: yourdomain.tld. IN DNSKEY blablablablabla)Your server is supposed to be authenticated using some other mean. (ie: X509 certs for https servers & cie)

Please also note that there are no "certificates" for DNSSEC, only very basic key pairs:

_ Generate your zone-signing keypair (rsa/dsa) and/or your key-singing keypair (idem). Generate them for the algorithms used in the zone (hopefully NSEC3, else NSEC and its damn zone-walk issue)_ Put the public key record in

In my experience, Comcast's DNS servers go down all the time, and even when they work, they sometimes have unexplained "glitches" that render websites unusable. Every time I try using their servers, this happens, and I switch back to something more stable, like L3. I'd be surprized to find anybody but a total n00b still using Comcast's DNS.

Interesting observation and sorry you have not had the best experience, but we have tens of millions of subscribers using our DNS. If you are experiencing issues with DNS, check out http://dns.comcast.net for some tools and other items. You may also want to look at your router/home gateway and see if its doing DNS proxying. Check out RFC5625 for more information.

Just saw an add for $29.99/month Comcast internet + cable (probably just broadcast, dunno) for 1 year. I think I cancelled my service too soon though (just last month). How long do I have to be "not a customer" to be a "new customer" ? Hmm, and IPv6 native service isn't that far away either. I'll probably switch back.

I would rather see Comcast improve their DNS server availability first, or at least in addition. For the last three months, I've turned to using another DNS provider because Comcast sees fit to run nightly maintenance on their servers sometime after 01:30 CST. Rarely has connection to the internet been compromised, rather to the DNS servers themselves. If they're using load-balancing hardware, I'm not seeing it as an end-user. Hopefully they can piggy-back a reliable high-availability architecture in ad

The Canadian Internet Registration Authority (CIRA) "has committed to the full deployment of DNSSEC, the security extensions for DNS, and has been conducting extensive research and analysis into the technical and operational impact of signing the dot-ca (.ca) zone file. The roll-out is anticipated in the later part of 2010."

CIRA is already providing a DNSSEC test bed for those interested in signing their own dot-ca name or interacting with a name server serving the signed dot-ca zone file.

DNSSEC Cache Poisoning has been confirmed just as I described. Note that many people are now advising to turn off DNSSEC validation.

Most officially, I discussed it in my DNSSEC NTIA comments:http://www.ntia.doc.gov/dns/comments/comment027.pdf [doc.gov]
in the section on Cache Poisoning. Notably, Vixie et al disputed
this when discussed on DNSOP and namedroppers. Guess they were wrong
again.